Welcome to the new FlexRadio Community! Please review the new Community Rules and other important new Community information on the Message Board.
If you are having a problem, please refer to the product documentation or check the Help Center for known solutions.
Need technical support from FlexRadio? It's as simple as Creating a HelpDesk ticket.

Remote access via VPN

KC9EI - Dave
KC9EI - Dave Member ✭✭
There are 4400+ conversations regarding VPN and remote access. I "think" I may be overlooking the obvious but here is my question:

Setup: 
WIN10 Professional
Firewall: PFsense - HA
VPN is PFsense's OpenVPN
Using hotspot from phone but have tried numerous hotspots with same results.

I can connect the VPN fine via an outside the firewall hotspot. 
I am able to ping all my local IP's 
I can remotely monitor local IP cameras with no issues.

BUT,,,, I cannot get the DAX or CAT functions to connect, even though for my purposes I appear to be on the local subnet and pingable.

My IP assigned by the VPN is "not" on the same subnet as the local site. Since the local IPs re pingable, doesn't this mean the networks are "bridged" already?

Any suggestions are appreciated. 

See you all in Dayton!!

Answers

  • KB4AAA
    KB4AAA Member ✭✭
    edited May 2018
    I don't know if PFsense has the option to choose TAP or TUN protocol check and make sure you are using the TAP protocol. I am using OpenVPN via Asus router with securepoint VPN for the Client.  Everything works just like it was on the same LAN. I have to use this option because my ISP appears not to support fragmented packets so Smartlink does not work very good (ie..no waterfall) On a side note my latency is about 50ms better on VPN than smartlink and I can use my antenna rotor software,and DAX so VPN kinda works better for me.
  • Neal - K3NC
    Neal - K3NC Inactive Employee ✭✭
    edited May 2018
    I would start with turning off your firewall. These seem to be the source of most problems when working on a local subnet.
  • Tim - W4TME
    Tim - W4TME Administrator, FlexRadio Employee admin
    edited May 2018
    Clarification: the PC software firewall, not the network firewall
  • KC9EI - Dave
    KC9EI - Dave Member ✭✭
    edited May 2018
    I will check it
    Thank you all
  • Mark G Thomas
    Mark G Thomas Member ✭✭
    edited May 2018
    Hi,

    I believe the answer is NO to the question: "My IP assigned by the VPN is not on the same subnet as the local site. Since the local IPs re pingable, doesn't this mean the networks are bridged already?"

    Flex radio discovery API wants the radio base to be in the same broadcast domain as the client -- IPs within the same subnet.

    I can ping my radio base from my WAN VPN just fine, but flex radio discovery does not work and SmartSDR (and Maestro) have no provision to specify the target radio IP manually, such as when not on the same subnet. There is further discussion about this here, and some work-arounds: https://community.flexradio.com/flexradio/topics/will-maestro-smartsdr-2-0-support-connecting-to-a-l...

    -Mark KC3DRE
  • Doug Hall
    Doug Hall Member ✭✭
    edited May 2018
    I'm in the same boat as Mark regarding Flex discovery with my VPN. I can ping the radio and I can use every other piece of IP connected gear on my network when connected via VPN, but the lack of a provision to "connect by IP" to the radio is a shortcoming in SSDR to me.

    Flex has made their position clear on this, and we just disagree.

    73,
    Doug K4DSP

  • Cliff - G4PZK
    Cliff - G4PZK Member ✭✭
    edited May 2018

    In this day and age it's just ridiculous to restrict the network connectivity. I can access my IC7800 from anywhere by IP.

    Cliff, G4PZK


  • Tim - W4TME
    Tim - W4TME Administrator, FlexRadio Employee admin
    edited May 2018
    The PFsense forums always provide a wealth of information.  You need a bridged VPN.
    https://forum.pfsense.org/index.php?topic=38605.0
  • Mark G Thomas
    Mark G Thomas Member ✭✭
    edited May 2018
    Unfortunately, in many WAN and multi-subnet LAN environments, passing broadcast packets is either impossible or undesirable. Broadcast traffic is considered network noise by those who work on network performance problems, not something you would want passing over a potentially bandwidth constrained remote link.

    I cannot use my Maestro or SmartSDR on my existing WiFi infrastructure, because the configuration (deliberately) uses a different subnet than the wired ethernet. I set up a separate same-subnet wifi access point exclusively for access to the Flex Radio base! (Why should I have to do this?)

    I cannot use my Cisco AnyConnect VPN and existing ASA firewalls for remote Maestro or SmartSDR Flex access, even though it works great for security cameras, remote climate control apps, media streaming, SmarSDR for iOS (allows entering target radio IP address!) and native iOS VPN, other remote radio control solutions, and remote voice-over-IP access.

    I cannot access my Flex from SmartSDR in VMware Fusion on a WiFi connected Mac Laptop, because WiFi adapters can't be put into promiscuous mode for the sake of guest VM traffic and a shared guest IP interface.

    I cannot use my Maestro at my office, because the site to site IPSEC WAN VPN cannot pass broadcast traffic, and due to security constraints I cannot change that.

    I cannot use my Maestro or SmartSDR from my favorite vacation spot, because of the broadcast VPN limitations, and hotel NAT that is incompatible with SmartLink, yet otherwise works just great with my AnyConnect SSL VPN.

    If there were a simple box where I could enter the target radio IP address, all these "cannots" would be "can" and I would be a happy customer.  "Flex" is an amazing and awesome piece of radio gear, but when it comes to networking is UN-FLEXIBLE due to this basic fundamental SmarSDR client-enforced limitation.
  • Doug Hall
    Doug Hall Member ✭✭
    edited May 2018
    Mark,
    I'd even be happy with a command line option, something like:

    SmartSDR.exe -a 192.168.0.100

    73,
    Doug K4DSP

  • Ron Koenig
    Ron Koenig Member ✭✭
    Seems we are back to begging for the ability to use our radios...

Leave a Comment

Rich Text Editor. To edit a paragraph's style, hit tab to get to the paragraph menu. From there you will be able to pick one style. Nothing defaults to paragraph. An inline formatting menu will show up when you select text. Hit tab to get into that menu. Some elements, such as rich link embeds, images, loading indicators, and error messages may get inserted into the editor. You may navigate to these using the arrow keys inside of the editor and delete them with the delete or backspace key.